CVE-2026-19023: The Hdf Group HDF5

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

Affected products

• The Hdf Group HDF5: up to and including 2.3.0

Published 2026-08-05. Last modified 2026-08-31.